Oracle plans 46 security updates for database, software |
 |
By Bill Brenner, Senior News Writer
13 Jul 2007 | SearchSecurity.com |
|
|
Oracle Corp. plans to release 46 security updates Tuesday to fix flaws attackers could exploit across its product line to tamper with database servers and host operating systems.
According to the July 2007 Critical Patch Update pre-release announcement Oracle released Thursday, DBAs can expect fixes for Oracle Database, Oracle Application Server, Oracle Collaboration Suite, Oracle E-Business Suite and Applications, and Oracle PeopleSoft Enterprise.
The Redwood Shores, Calif.-based database giant offered the following breakdown:
Oracle Database is affected by 20 vulnerabilities including one in Application Express. Two of the flaws are remotely exploitable without authentication.
Oracle Application Server is affected by four vulnerabilities, three of which are remotely exploitable without authentication.
Oracle Collaboration Suite has one vulnerability that's remotely exploitable but requires authentication.
Oracle E-Business Suite and Applications is affected by 14 vulnerabilities, six of which are remotely exploitable without authentication.
Oracle PeopleSoft Enterprise PeopleTools is affected by three vulnerabilities, one of which is remotely exploitable without authentication. PeopleSoft Enterprise Customer Relationship Management is affected by two flaws, and PeopleSoft Enterprise Human Capital Management is affected by two flaws.
While details on the specific flaws have yet to be released, Cupertino, Calif.-based antivirus vendor Symantec Corp. offered customers of its DeepSight threat management service an emailed list of steps IT shops could take to reduce the risk of Oracle attacks until patches are deployed.
Steps include blocking external access at the network boundary unless external parties require service. "Configure network perimeter devices to block all access to ports and services that are not intended for public consumption," Symantec advised. "Permit access to only those services that are intended to be accessed by public users."
IT shops should also be sure to run all software as a non-privileged user with minimal access rights and implement multiple redundant layers of security, Symantec said.
"Deploy memory-protection schemes and host-based IPS on critical systems," the company added. "This tactic may complicate attempts to exploit latent vulnerabilities in protected applications and services."
|
|
|
|
